Please address the comments from this code review:

## Overall Comments
- Consider whether `toCompliance` should be buffered, since `forwardToCompliance` is called inline from `ProcessMessage` and an unbuffered channel here could back up Central’s ACK processing if the compliance multiplexer is slow or temporarily blocked.
- In `forwardToCompliance`, you set `Hostname` and `Broadcast` based solely on `resourceID`; double-check that using the VM resource ID as `Hostname` and broadcasting only when `resourceID == ""` matches the expectations of the compliance side consumers (if not, it may be worth adding a small helper or comment clarifying the mapping).

## Individual Comments

### Comment 1
<location path="sensor/common/virtualmachine/index/handler_impl.go" line_range="167" />
<code_context>
 		return errStartMoreThanOnce
 	}
 	h.indexReports = make(chan *v1.IndexReport, env.VirtualMachinesIndexReportsBufferSize.IntegerSetting())
+	h.toCompliance = make(chan common.MessageToComplianceWithAddress)
 	h.toCentral = h.run(h.indexReports)
 	return nil
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Consider buffering the compliance channel to avoid blocking ACK processing when Compliance is slow or temporarily unavailable.

Because `toCompliance` is unbuffered, `forwardToCompliance` will block until the consumer reads, and `ProcessMessage` is on the hot ACK/NACK path. If Compliance is slow or backpressured, this can stall ACK handling. A small buffer (as used for other internal channels) would mitigate head-of-line blocking while still preserving ordering.

Suggested implementation:

```golang
	if h.toCentral != nil || h.indexReports != nil || h.toCompliance != nil {
		return errStartMoreThanOnce
	}
	h.indexReports = make(chan *v1.IndexReport, env.VirtualMachinesIndexReportsBufferSize.IntegerSetting())
	h.toCompliance = make(chan common.MessageToComplianceWithAddress, env.VirtualMachinesToComplianceBufferSize.IntegerSetting())

```

1. Define `VirtualMachinesToComplianceBufferSize` in the `env` package (or equivalent config) following the same pattern used for `VirtualMachinesIndexReportsBufferSize` (type, default, description, etc.).
2. If there is an existing common buffer size setting for internal VM handler channels (e.g., a shared constant/env var), you may want to reuse that instead of introducing a new one, for consistency.
3. Ensure any unit tests that construct `handlerImpl` or validate channel behavior are updated to account for the buffered `toCompliance` channel (e.g., tests that might have assumed it was unbuffered).
</issue_to_address>

### Comment 2
<location path="sensor/common/virtualmachine/index/handler_impl.go" line_range="240-242" />
<code_context>
+		return
+	}
+
+	select {
+	case <-h.stopper.Flow().StopRequested():
+	case h.toCompliance <- common.MessageToComplianceWithAddress{
+		Msg: &sensor.MsgToCompliance{
+			Msg: &sensor.MsgToCompliance_ComplianceAck{
</code_context>
<issue_to_address>
**suggestion:** Consider handling or at least logging when messages are dropped due to sensor shutdown.

Here, when `h.stopper.Flow().StopRequested()` fires, the select exits and the ACK/NACK is silently dropped. If these messages matter for Compliance accounting, this makes shutdown issues hard to trace. Please add at least a debug log or a counter for messages dropped due to shutdown to make this behavior observable.
</issue_to_address>

Please address the comments from this code review:

## Overall Comments
- The new `toCompliance` channel is unbuffered and used in the ACK hot path; consider adding a small buffer or a clearly non-blocking send strategy so slow compliance handling cannot block processing of Central messages.
- In `forwardToCompliance`, the VM `resourceID` is used both as `Hostname` and to decide `Broadcast`; it would be good to double-check that these semantics match how the compliance multiplexer routes messages (e.g., whether VM IDs should be treated as hostnames or if a more explicit addressing field is needed).

## Individual Comments

### Comment 1
<location path="sensor/common/virtualmachine/index/handler_impl_test.go" line_range="230-231" />
<code_context>
 func (s *virtualMachineHandlerSuite) TestCapabilities() {
 	caps := s.handler.Capabilities()
-	s.Require().Empty(caps)
+	s.Require().Len(caps, 1)
+	s.Contains(caps, centralsensor.SensorACKSupport)
 }

</code_context>
<issue_to_address>
**suggestion (testing):** Add tests for the new compliance-forwarding behavior and lifecycle methods (forwardToCompliance, ComplianceC, Stopped).

The capabilities test now checks that `SensorACKSupport` is declared, but it doesn’t exercise the new behavior it enables. Please add tests that cover:

1. **forwardToCompliance happy paths**
   - After `Start()` (so `toCompliance` is initialized), processing a `central.SensorACK` with `ACK` produces a message on `ComplianceC()` with:
     - `Msg.ComplianceAck.Action == sensor.MsgToCompliance_ComplianceACK_ACK`
     - `MessageType == VM_INDEX_REPORT`
     - `ResourceId` and `Reason` correctly propagated.
   - Same for `NACK`, including forwarding `Reason`.

2. **Forwarding edge cases**
   - `toCompliance == nil` (no `Start()`): `ProcessMessage`/`forwardToCompliance` should not panic or block.
   - Unknown `SensorACK_Action`: should be logged and dropped, with `ComplianceC()` remaining empty.

3. **Stopped()/stopper behavior**
   - When `stopper.Flow().Stop()` is triggered, `forwardToCompliance` should not block on a full `toCompliance` channel. You can set up a non-drained channel, call `Stop()`, then invoke `ProcessMessage`.

4. **ComplianceC wiring**
   - Verify that `Start()` initializes `ComplianceC()` (non-nil, readable) and that it’s the same channel used internally.

These will demonstrate the ACK/NACK path to compliance and ensure no-Start, unknown actions, and stop conditions are handled safely.

Suggested implementation:

```golang
func (s *virtualMachineHandlerSuite) TestCapabilities() {
	caps := s.handler.Capabilities()
	s.Require().Len(caps, 1)
	s.Contains(caps, centralsensor.SensorACKSupport)
}

// forwardToCompliance happy-path: ACK
func (s *virtualMachineHandlerSuite) TestForwardToCompliance_ACK() {
	// Ensure Start wires up the compliance channel
	err := s.handler.Start(s.ctx, nil)
	s.Require().NoError(err)
	defer s.handler.Stop(s.ctx)

	complianceC := s.handler.ComplianceC()
	s.Require().NotNil(complianceC)

	const (
		resourceID = "vm-123"
		reason     = "all good"
	)

	ack := &central.SensorACK{
		Action:     central.SensorACK_ACK,
		ResourceId: resourceID,
		Reason:     reason,
	}

	msg := &central.MsgFromSensor{
		Msg: &central.MsgFromSensor_SensorAck{
			SensorAck: ack,
		},
	}

	err = s.handler.ProcessMessage(msg)
	s.Require().NoError(err)

	select {
	case toComplianceMsg := <-complianceC:
		s.Require().NotNil(toComplianceMsg)
		s.Require().NotNil(toComplianceMsg.Msg)
		complianceAck := toComplianceMsg.Msg.GetComplianceAck()
		s.Require().NotNil(complianceAck)
		s.Equal(sensor.MsgToCompliance_ComplianceACK_ACK, complianceAck.Action)
		s.Equal(sensor.MessageType_VM_INDEX_REPORT, complianceAck.MessageType)
		s.Equal(resourceID, complianceAck.ResourceId)
		s.Equal(reason, complianceAck.Reason)
	case <-time.After(2 * time.Second):
		s.Fail("timed out waiting for compliance ACK message")
	}
}

// forwardToCompliance happy-path: NACK
func (s *virtualMachineHandlerSuite) TestForwardToCompliance_NACK() {
	err := s.handler.Start(s.ctx, nil)
	s.Require().NoError(err)
	defer s.handler.Stop(s.ctx)

	complianceC := s.handler.ComplianceC()
	s.Require().NotNil(complianceC)

	const (
		resourceID = "vm-456"
		reason     = "validation failed"
	)

	nack := &central.SensorACK{
		Action:     central.SensorACK_NACK,
		ResourceId: resourceID,
		Reason:     reason,
	}

	msg := &central.MsgFromSensor{
		Msg: &central.MsgFromSensor_SensorAck{
			SensorAck: nack,
		},
	}

	err = s.handler.ProcessMessage(msg)
	s.Require().NoError(err)

	select {
	case toComplianceMsg := <-complianceC:
		s.Require().NotNil(toComplianceMsg)
		s.Require().NotNil(toComplianceMsg.Msg)
		complianceAck := toComplianceMsg.Msg.GetComplianceAck()
		s.Require().NotNil(complianceAck)
		s.Equal(sensor.MsgToCompliance_ComplianceACK_NACK, complianceAck.Action)
		s.Equal(sensor.MessageType_VM_INDEX_REPORT, complianceAck.MessageType)
		s.Equal(resourceID, complianceAck.ResourceId)
		s.Equal(reason, complianceAck.Reason)
	case <-time.After(2 * time.Second):
		s.Fail("timed out waiting for compliance NACK message")
	}
}

// Edge case: no Start() called, toCompliance is nil – should not panic or block
func (s *virtualMachineHandlerSuite) TestForwardToCompliance_NoStartDoesNotPanicOrBlock() {
	// Do NOT call Start()

	ack := &central.SensorACK{
		Action:     central.SensorACK_ACK,
		ResourceId: "vm-no-start",
		Reason:     "ignored",
	}

	msg := &central.MsgFromSensor{
		Msg: &central.MsgFromSensor_SensorAck{
			SensorAck: ack,
		},
	}

	done := make(chan struct{})
	go func() {
		defer close(done)
		_ = s.handler.ProcessMessage(msg)
	}()

	select {
	case <-done:
		// ok, returned without panic/block
	case <-time.After(2 * time.Second):
		s.Fail("ProcessMessage should not block when Start() has not been called")
	}

	// ComplianceC() may be nil or empty; in either case we must not block.
	if ch := s.handler.ComplianceC(); ch != nil {
		select {
		case <-ch:
			s.Fail("no message should be forwarded to compliance when Start() was not called")
		default:
		}
	}
}

// Edge case: unknown SensorACK_Action should be logged and dropped
func (s *virtualMachineHandlerSuite) TestForwardToCompliance_UnknownActionDropped() {
	err := s.handler.Start(s.ctx, nil)
	s.Require().NoError(err)
	defer s.handler.Stop(s.ctx)

	complianceC := s.handler.ComplianceC()
	s.Require().NotNil(complianceC)

	unknownAck := &central.SensorACK{
		Action:     central.SensorACK_Action(999),
		ResourceId: "vm-unknown",
		Reason:     "unknown",
	}

	msg := &central.MsgFromSensor{
		Msg: &central.MsgFromSensor_SensorAck{
			SensorAck: unknownAck,
		},
	}

	err = s.handler.ProcessMessage(msg)
	s.Require().NoError(err)

	// Channel should remain empty (message dropped)
	select {
	case <-complianceC:
		s.Fail("unexpected message on ComplianceC for unknown SensorACK action")
	default:
	}
}

// Stopped()/stopper behavior: forwardToCompliance must not block on full channel after Stop
func (s *virtualMachineHandlerSuite) TestForwardToCompliance_DoesNotBlockWhenStopped() {
	err := s.handler.Start(s.ctx, nil)
	s.Require().NoError(err)
	defer s.handler.Stop(s.ctx)

	complianceC := s.handler.ComplianceC()
	s.Require().NotNil(complianceC)

	// Fill the channel to capacity. This assumes a small buffer; if capacity is unknown,
	// we conservatively send until a non-blocking send fails.
	for i := 0; i < cap(complianceC); i++ {
		select {
		case complianceC <- &sensor.MsgToCompliance{}:
		default:
			// Channel is already full.
			break
		}
	}

	// Trigger stopper/Stopped behavior
	s.handler.Stop(s.ctx)

	nack := &central.SensorACK{
		Action:     central.SensorACK_NACK,
		ResourceId: "vm-stopped",
		Reason:     "after stop",
	}

	msg := &central.MsgFromSensor{
		Msg: &central.MsgFromSensor_SensorAck{
			SensorAck: nack,
		},
	}

	done := make(chan struct{})
	go func() {
		defer close(done)
		_ = s.handler.ProcessMessage(msg)
	}()

	select {
	case <-done:
		// ok, no blocking on full compliance channel after stop
	case <-time.After(2 * time.Second):
		s.Fail("ProcessMessage should not block when handler has been stopped, even if ComplianceC is full")
	}
}

// ComplianceC wiring: Start initializes non-nil channel used internally
func (s *virtualMachineHandlerSuite) TestStartInitializesComplianceC() {
	// Before Start, ComplianceC may be nil or undefined; we only assert post-Start behavior.
	err := s.handler.Start(s.ctx, nil)
	s.Require().NoError(err)
	defer s.handler.Stop(s.ctx)

	complianceC := s.handler.ComplianceC()
	s.Require().NotNil(complianceC)

	ack := &central.SensorACK{
		Action:     central.SensorACK_ACK,
		ResourceId: "vm-wiring",
		Reason:     "wiring-test",
	}

	msg := &central.MsgFromSensor{
		Msg: &central.MsgFromSensor_SensorAck{
			SensorAck: ack,
		},
	}

	err = s.handler.ProcessMessage(msg)
	s.Require().NoError(err)

	select {
	case <-complianceC:
		// message observed on same channel returned by ComplianceC()
	case <-time.After(2 * time.Second):
		s.Fail("expected a message on ComplianceC after processing SensorACK")
	}
}

func (s *virtualMachineHandlerSuite) TestAccepts() {

```

To make these tests compile and integrate cleanly, you will also need to:

1. Ensure the following imports exist in `handler_impl_test.go` (adjust paths to match your existing imports):
   - `time`
   - `github.com/stackrox/rox/generated/internalapi/central`
   - `github.com/stackrox/rox/generated/internalapi/sensor`
   - If `centralsensor.SensorACKSupport` is defined in a different package, keep the existing import for `centralsensor`.
2. Confirm the handler API:
   - `Start` / `Stop` signatures `(ctx context.Context, _ any)` or similar may differ; update the test calls accordingly.
   - `ComplianceC()` should return `chan *sensor.MsgToCompliance`; if it returns a receive-only channel, remove the direct sends in `TestForwardToCompliance_DoesNotBlockWhenStopped` and instead pre-fill the internal channel via the handler (or expose capacity via a helper).
   - If `Stop` is not a method, but the suite exposes a stopper (`s.stopper.Flow().Stop()`), invoke that instead of `s.handler.Stop(s.ctx)`.
3. Adjust enum names if they differ slightly from these guesses:
   - `central.SensorACK_ACK`, `central.SensorACK_NACK`, `central.SensorACK_Action`
   - `sensor.MsgToCompliance_ComplianceACK_ACK`, `sensor.MsgToCompliance_ComplianceACK_NACK`
   - `sensor.MessageType_VM_INDEX_REPORT`
4. If the suite uses a different context field than `s.ctx`, or uses `SetupTest`/`TearDownTest` to manage lifecycle, align the test setup/teardown with that pattern (e.g. omit explicit `Start`/`Stop` if already done in `SetupTest`).
</issue_to_address>

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="sensor/common/virtualmachine/index/handler_impl.go" line_range="143" />
<code_context>
-		// TODO(ROX-xxxxx): Implement retry logic or notifying VM relay.
-		// Currently, the VM relay has its own retry mechanism, but it's not aware of Central's rate limiting.
-	}
+	metrics.IndexReportAcksReceived.WithLabelValues(action.String()).Inc()

 	return nil
</code_context>
<issue_to_address>
**suggestion:** Metrics are incremented even for unknown ACK actions, which may pollute metric labels

In `forwardToCompliance`, the `default` branch treats any non-ACK/NACK as unknown and returns early, but the metric is still incremented with `action.String()`. This will introduce label values for unsupported actions that Compliance never processes. Consider only incrementing for known actions or tracking unknown actions in a separate metric/label to avoid polluting the primary series.

Suggested implementation:

```golang

```

`.

Here are the changes:

<file_operations>
<file_operation operation="edit" file_path="sensor/common/virtualmachine/index/handler_impl.go">
<<<<<<< SEARCH
	metrics.IndexReportAcksReceived.WithLabelValues(action.String()).Inc()
=======
>>>>>>> REPLACE
</file_operation>
</file_operations>

<additional_changes>
Inside `forwardToCompliance` (in `handler_impl.go`), adjust the switch that handles the ACK action (the one using `action` and with a `default` branch that returns early on unknown actions):

1. In the `case` branch that handles the ACK action, add:
   ```go
   metrics.IndexReportAcksReceived.WithLabelValues(action.String()).Inc()
   ```
   close to where the ACK is successfully processed (before returning / sending to Compliance).

2. In the `case` branch that handles the NACK action, also add:
   ```go
   metrics.IndexReportAcksReceived.WithLabelValues(action.String()).Inc()
   ```
   again, only after the NACK has been validated as a supported action and is being processed.

3. Do **not** add any metric increment in the `default` branch; keep it returning early for unknown actions. This ensures that `IndexReportAcksReceived` is only incremented for supported actions and avoids label pollution from unknown values.

4. If you want visibility into unsupported actions, consider adding a separate counter, e.g.:
   ```go
   metrics.IndexReportAcksUnknownActions.Inc()
   ```
   inside the `default` branch, using a metric with no `action` label (or with a bounded "reason" label) so it doesn't create unbounded series.
</issue_to_address>